CVE - CVE-2010-0840

CVE-ID
CVE-2010-0840	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BUGTRAQ:20100405 ZDI-10-056: Sun Java Runtime Environment Trusted Methods Chaining Remote Code Execution Vulnerability URL:http://www.securityfocus.com/archive/1/510528/100/0/threaded BUGTRAQ:20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX URL:http://www.securityfocus.com/archive/1/516397/100/0/threaded MISC:http://www.zerodayinitiative.com/advisories/ZDI-10-056 CONFIRM:http://www.oracle.com/technetwork/topics/security/javacpumar2010-083341.html CONFIRM:http://support.apple.com/kb/HT4170 CONFIRM:http://support.apple.com/kb/HT4171 CONFIRM:http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html CONFIRM:http://www.vmware.com/security/advisories/VMSA-2011-0003.html CONFIRM:http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html APPLE:APPLE-SA-2010-05-18-1 URL:http://lists.apple.com/archives/security-announce/2010//May/msg00001.html APPLE:APPLE-SA-2010-05-18-2 URL:http://lists.apple.com/archives/security-announce/2010//May/msg00002.html HP:HPSBMA02547 URL:http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751 HP:SSRT100179 URL:http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751 HP:HPSBMU02799 URL:http://marc.info/?l=bugtraq&m=134254866602253&w=2 HP:HPSBUX02524 URL:http://marc.info/?l=bugtraq&m=127557596201693&w=2 HP:SSRT100089 URL:http://marc.info/?l=bugtraq&m=127557596201693&w=2 MANDRIVA:MDVSA-2010:084 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2010:084 REDHAT:RHSA-2010:0337 URL:http://www.redhat.com/support/errata/RHSA-2010-0337.html REDHAT:RHSA-2010:0338 URL:http://www.redhat.com/support/errata/RHSA-2010-0338.html REDHAT:RHSA-2010:0339 URL:http://www.redhat.com/support/errata/RHSA-2010-0339.html REDHAT:RHSA-2010:0383 URL:http://www.redhat.com/support/errata/RHSA-2010-0383.html REDHAT:RHSA-2010:0471 URL:http://www.redhat.com/support/errata/RHSA-2010-0471.html REDHAT:RHSA-2010:0489 URL:http://www.redhat.com/support/errata/RHSA-2010-0489.html SUSE:SUSE-SR:2010:008 URL:http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html SUSE:SUSE-SR:2010:011 URL:http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html SUSE:SUSE-SR:2010:017 URL:http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html UBUNTU:USN-923-1 URL:http://ubuntu.com/usn/usn-923-1 BID:39065 URL:http://www.securityfocus.com/bid/39065 OVAL:oval:org.mitre.oval:def:9974 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9974 OVAL:oval:org.mitre.oval:def:13971 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13971 SECUNIA:39292 URL:http://secunia.com/advisories/39292 SECUNIA:39317 URL:http://secunia.com/advisories/39317 SECUNIA:39659 URL:http://secunia.com/advisories/39659 SECUNIA:39819 URL:http://secunia.com/advisories/39819 SECUNIA:40211 URL:http://secunia.com/advisories/40211 SECUNIA:40545 URL:http://secunia.com/advisories/40545 SECUNIA:43308 URL:http://secunia.com/advisories/43308 VUPEN:ADV-2010-1107 URL:http://www.vupen.com/english/advisories/2010/1107 VUPEN:ADV-2010-1191 URL:http://www.vupen.com/english/advisories/2010/1191 VUPEN:ADV-2010-1454 URL:http://www.vupen.com/english/advisories/2010/1454 VUPEN:ADV-2010-1523 URL:http://www.vupen.com/english/advisories/2010/1523 VUPEN:ADV-2010-1793 URL:http://www.vupen.com/english/advisories/2010/1793
Assigning CNA
N/A
Date Entry Created
20100303	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20100303)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org